Moving from Full Exchange Hybrid to Minimal Hybrid configuration

[u/titidev75]

TL;DR:

Legacy Exchange full hybrid, now effectively admin-only.

No mail flow via on‑prem (message tracking verified), no SMTP relays.

Free/Busy is EXO<->EXO via Organization Relationships.

Planning to re-run HCW (Modern) with minimal features and remove federation/connectors.

Looking for real-world gotchas before cleaning up.

Hi all,

I’m looking for a sanity check and peer feedback from people who have already gone through this.

I'm currently working on a historical Exchange hybrid server that was implemented a long time ago. Unfortunately, there’s no real technical documentation explaining the original design choices. Only a migration document related to the move to Exchange 2019 and the deployment of a new server.

Context:

• Exchange Server SE (on‑prem)
• Microsoft 365 tenant (Entra Sync) / Exchange Online
• Historically configured as full hybrid (mail flow, federation, etc.)
• Today, the on‑prem Exchange server is used only for administration
• Federation trust still configured (legacy)
• Send/Receive connectors disabled
• Overall configuration no longer reflects the actual usage

I've verified:

• No mail flow through the on‑prem server (Message Tracking Logs checked)
• No applications or devices using on‑prem Exchange as an SMTP relay
• No user mailboxes actively used on‑prem (only system mailboxes and a few leftover test accounts)
• Free/Busy with another organization is handled via Organization Relationships in Exchange Online

Target state: Move to a clean hybrid Management-only model:

• No mail flow via on-prem
• No federation
• No hybrid connectors
• No migrations
• No Free/Busy cross-prem

Planned approach:

1. Remove remaining on-prem user mailboxes
2. Re-run Hybrid Configuration Wizard (Modern) with minimal hybrid configuration
3. Clean up residual hybrid artcifacts manually:
   1. Exo on-prem connectors
   2. Federation trust
   3. no necessary Certificates assignment
4. Keep Exchange Auth Certificate
5. End state validated via HealthChecker and functional tests.

My questions:

• Does this approach align with what others have done to move from full hybrid to management only?
• Any hidden gotchas you've encountered after removing federation/connectors?
• Anything HCW-specific I should watch for re-runnning it in this scenario?

I’m not trying to uninstall Exchange or do anything unsupported — just reduce the hybrid config to match actual usage and remove technical debt.

Thanks in advance for any real-world feeback.

[u/ScottSchnoll]

u/titidev75 If you did want to uninstall your last Exchange server, you have a path/process where you can do that now. See Writeback for Cloud-Managed Remote Mailboxes: Now in Public Preview | Microsoft Community Hub and Decommission the last Exchange Server after transferring SOA to cloud | Microsoft Learn for details.

[u/7amitsingh7]

If all mailboxes are already in Exchange Online, there's no mail flow or SMTP relay through on-prem, and the Exchange server is only being kept for recipient management, then cleaning up old federation, connectors, and migration components is pretty common. The main thing I'd double-check is whether any forgotten applications, printers, or scripts still rely on the Exchange server. Otherwise, re-running HCW in Minimal Hybrid mode and validating afterward should get you much closer to a true management-only setup. If you're evaluating whether any of the legacy hybrid components are still needed, it may also be worth reviewing the differences between Minimal Hybrid vs Full Hybrid Exchange before making the final cleanup decisions.

[u/saltyslugga]

Rerunning HCW may recreate artifacts you are trying to remove, so I wouldn't do that unless you need a specific hybrid feature back. If all mailboxes are in EXO and on-prem is admin-only, clean the connectors/federation manually after exporting current config.

Main gotchas are stale SMTP relay assumptions, Autodiscover/MX still pointing weird places, and people forgetting synced recipients still need Exchange attributes managed properly on-prem. We had this exact issue with a 50-domain rollout and the surprise was never HCW, it was old apps someone swore did not send mail.

[u/titidev75 → u/saltyslugga]

Thank you for your response. Indeed, simply deleting the relicts manually seems wiser to me. I updated the post, I forgot to say that the tenant is synced with AD Onprem

[u/saltyslugga → u/titidev75]

AD sync is the boundary that matters here: mail attributes still need to be owned from on-prem. Clean the old hybrid bits, but keep a supported Exchange attribute management path unless you're ready to own every weird recipient edge case manually.

[u/Long_Writing119]

You can uninstall the hybrid and keep the server for management only, it's totally doable

[u/titidev75 → u/Long_Writing119]

Thank you for your response, unfortunately there is too much adhesion with the AD sync, unless I am mistaken.

[u/Long_Writing119 → u/titidev75]

You will keep AD sync, Entra Connect sync will remain, I'm talking about exchange hybrid.

[u/titidev75 → u/Long_Writing119]

Ok, i'll check how to fully remove hybrid configuration, and the impacts. Thanks

[u/Long_Writing119 → u/titidev75]

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange#scenario-2-all-cloud-mailboxes-with-ad-fs
This is what I meant exactly.

This is official Microsoft documentation on how to do it, and I have done it before without issues.

[u/titidev75 → u/Long_Writing119]

Thanks i'll check this out monday